What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-28 compared with 2024-03-27 · 73 added, 71 removed, 26 unchanged (85% of the section changed)

1 unchanged sentence

Cybersecurity.

Sponsor, its parent Valkyrie Investments Inc., and their respective affiliates (collectively, “Valkyrie”) have adopted an

organizational wide cybersecurity program.

The program is administered by the Chief Compliance Officer (“CCO”) of Valkyrie

Funds, LLC, an affiliate of the Sponsor and wholly-owned subsidiary of Valkyrie Investments Inc.

Valkyrie’s objective, in the development

and implementation of this comprehensive cybersecurity program, is to create effective administrative, technical, and physical safeguards

for the protection of personal information of the organization and its clients.

has designated the CCO to implement and maintain the cybersecurity program.

The CCO may delegate any of the CCO’s responsibilities

to appropriate designees as long as the CCO remains primarily responsible for compliance oversight and administration.

The CCO will is

responsible for:

Cybersecurity

Sponsor has adopted an organizational wide cybersecurity program.

The program is administered by the Head of IT of the Sponsor

(the “Head of IT”).

The Sponsor’s objective, in the development and implementation of this comprehensive cybersecurity

program, is to create effective administrative, technical, and physical safeguards for the protection of personal information

of the organization and its clients.

Sponsor has designated the Head of IT to implement and maintain the cybersecurity program.

The Head of IT may delegate any of

the Head of IT’s responsibilities to appropriate designees as long as the Head of IT remains primarily responsible for compliance

oversight and administration.

The Head of IT will is responsible for:

implementation of the cybersecurity program;

2 unchanged sentences

the ability of each of our third party service providers to implement and maintain appropriate

security measures for the personal information to which we have permitted them access, and

requiring such third party service providers by contract to implement and maintain appropriate

security measures.

the scope of the security measures in the cybersecurity program at least annually, or whenever

there is a material change in our business practices that may implicate the security or integrity

of records containing personal information.

security measures for the personal information to which we have permitted them access,

and requiring such third party service providers by contract to implement and maintain

appropriate security measures.

the scope of the security measures in the cybersecurity program at least annually, or

whenever there is a material change in our business practices that may implicate the

security or integrity of records containing personal information.

Identification

of Risks and Cybersecurity Governance

combat internal risks to the security, confidentiality, and/or integrity of any electronic records containing personal information, and

evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, Valkyrie has identified

the following risks that are present to its business as well as procedures to help mitigate those risks:

combat internal risks to the security, confidentiality, and/or integrity of any electronic records containing personal information,

and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, the Sponsor

has identified the following risks that are present to its business as well as procedures to help mitigate those risks:

must be communication to employees on the detailed provisions of the cybersecurity program

2 unchanged sentences

who are reasonably required to know such information.

security measures shall be reviewed at least annually, or whenever there is a material change

in our business practices that may reasonably implicate the security or integrity of records

containing personal information.

employees must return all records containing personal information, in any form, that may

at the time of such termination be in the former employee’s possession.

terminated employee’s physical and electronic access to personal information must be

immediately blocked.

Such terminated employee shall be required to surrender all keys, IDs

or access codes or badges, business cards, and the like, that permit access to the firm’s

premises or information.

Moreover, such terminated employee’s remote electronic access

to personal information must be disabled;

his/her voicemail access, e-mail access, internet

access, and passwords must be invalidated.

employees’ user ID’s and passwords must be managed in accordance to Valkyrie’s

security measures shall be reviewed at least annually, or whenever there is a material

change in our business practices that may reasonably implicate the security or integrity

of records containing personal information.

employees must return all records containing personal information, in any form, that

may at the time of such termination be in the former employee’s possession.

terminated employee’s physical and electronic access to personal information must

be immediately blocked.

Such terminated employee shall be required to surrender all keys,

IDs or access codes or badges, business cards, and the like, that permit access to the

firm’s premises or information.

Moreover, such terminated employee’s remote

electronic access to personal information must be disabled;

his/her voicemail access,

e-mail access, internet access, and passwords must be invalidated.

employees’ user ID’s and passwords must be managed in accordance to the Sponsor’s

password policy.

2 unchanged sentences

screen when they are not at their desks.

Employees are responsible for locking computer screen

when away from workspace.

Employees are responsible for locking computer

screen when away from workspace.

must not share login information with co-workers.

will maintain reasonably up-to-date firewall protection (if applicable) and operating system

security patches, reasonably designed to maintain the integrity of the personal information,

Sponsor will maintain reasonably up-to-date firewall protection (if applicable) and operating

system security patches, reasonably designed to maintain the integrity of the personal

information, installed on systems processing personal information.

Sponsor will maintain reasonably up-to-date versions of system security agent software

which must include malware protection and reasonably up-to-date patches and virus definitions,

installed on systems processing personal information.

will maintain reasonably up-to-date versions of system security agent software which must

include malware protection and reasonably up-to-date patches and virus definitions, installed

on systems processing personal information.

the extent technically feasible, personal information stored on portable devices, such as

laptops or tablets, must be password protected, as must all records and files transmitted

the extent technically feasible, personal information stored on portable devices, such

as laptops or tablets, must be password protected, as must all records and files transmitted

across public networks or wirelessly, to the extent technically feasible.

1 unchanged sentence

Associated with Remote Client Access and Funds Transfer Requests

Valkyrie does not provide its clients with online account access nor does process funds transfer requests.

If the firm’s business

changes to allow for remote client access and funds transfer requests, Valkyrie will update the cybersecurity program accordingly by

identifying the potential risks involved and implementing the appropriate safeguards to protect the client’s personal information.

the Sponsor does not provide its clients with online account access nor does process funds transfer requests.

If the firm’s

business changes to allow for remote client access and funds transfer requests, the Sponsor will update the cybersecurity program

accordingly by identifying the potential risks involved and implementing the appropriate safeguards to protect the client’s

personal information.

Associated with Vendors and Other Third Parties

periodically conducts risk assessments with vendors and other third parties that have access to the Firm’s networks, customer data,

and other sensitive information.

Sponsor periodically conducts risk assessments with vendors and other third parties that have access to the Firm’s networks,

customer data, and other sensitive information.

of Unauthorized Activity

who believe their terminal or computer systems have been subjected to unauthorized activity, or has otherwise been improperly accessed

or used, are required to report the situation to the CCO immediately to determine the course of action.

takes the issue of security seriously.

Firm employees who use the technology and information resources of the firm must be aware that

they can be disciplined if they violate this policy.

Upon violation of this policy, an employee may be subject to discipline up to and

including discharge.

The specific discipline imposed will be determined by a case-by-case basis, taking into consideration the nature

and severity of the violation of the cybersecurity program, prior violations of the policy committed by the individual, state and federal

laws and all other relevant information.

a case where the accused person is not a firm employee, the matter shall be submitted to the CCO.

The CCO may refer the information to

law enforcement agencies and/or prosecutors for consideration as to whether criminal charges should be filed against the alleged violator(s).

who believe their terminal or computer systems have been subjected to unauthorized activity, or has otherwise been improperly

accessed or used, are required to report the situation to the Head of IT immediately to determine the course of action.

Sponsor takes the issue of security seriously.

Firm employees who use the technology and information resources of the firm must

be aware that they can be disciplined if they violate this policy.

Upon violation of this policy, an employee may be subject to

discipline up to and including discharge.

The specific discipline imposed will be determined by a case-by-case basis, taking into

consideration the nature and severity of the violation of the cybersecurity program, prior violations of the policy committed

by the individual, state and federal laws and all other relevant information.

a case where the accused person is not a firm employee, the matter shall be submitted to the Head of IT.

The Head of IT may refer

the information to law enforcement agencies and/or prosecutors for consideration as to whether criminal charges should be filed

against the alleged violator(s).

to the Cybersecurity Program

CCO reviews the cybersecurity program on a periodic basis and updates the program based on changes in the firm’s business, effectiveness

of the safeguards, and any additional risk factors that become present.

The CCO will inform management of the results of the reviews

and any recommendations for improved security arising out of the reviews.

if an incident occurs that is determined to be in violation of the cybersecurity program, there shall be an immediate mandatory post-incident

review of events and actions taken, if any, with a view to determining whether any changes in our security practices are required to

improve the security of personal information for which the Firm is responsible.

Head of IT reviews the cybersecurity program on a periodic basis and updates the program based on changes in the firm’s

business, effectiveness of the safeguards, and any additional risk factors that become present.

The Head of IT will inform management

of the results of the reviews and any recommendations for improved security arising out of the reviews.

if an incident occurs that is determined to be in violation of the cybersecurity program, there shall be an immediate mandatory

post-incident review of events and actions taken, if any, with a view to determining whether any changes in our security practices

are required to improve the security of personal information for which the Firm is responsible.

Legal Proceedings.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments